Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

App Locker Path Exception issue

Posted on 2013-11-05
2
Medium Priority
?
2,331 Views
Last Modified: 2013-11-05
I'm using App Locker to secure my workstations, primarily as an anti-malware step, and it works very well.

I now have a new piece of software, that upon login, copies a batch file to the users %TEMP% directory, and runs it.

Of course, that's one of the directories that I have prevented batch files from running, so now I'm trying to allow just this batch file to run, as I know it is known good.  I cannot change the location where this batch file runs, the software maker does not allow for that type of modification.

Oh, and to just make it slightly harder, when the software copies the batch file to the TEMP dir, it uses a new file name every time (however there is a consistent file naming convention, so I'm hoping to use that to key in on this)

Here is what I've done.  I create an App Locker script deny rule, that denies scripts from running from this directory:

%OSDRIVE%\Users\*\AppData\Local\Temp\*

That works beautifully.  No batch files (or any other scripts) can run.

Next step, allow all batch files by putting in this exception:

%OSDRIVE%\Users\*\AppData\Local\Temp\*.bat

That also works perfectly.  All batch files can run, but no other scripts.

Last step is to pin it down to only the known good batch files, that get copied upon login.  The batch files are always named like this:  "ABC12ws.bat" or "ABCh42s.bat".  The common thread is they always start with "ABC" then followed by 4 randomly generated characters, then the .bat.

So I thought I could easily modify my exception like this:

%OSDRIVE%\Users\*\AppData\Local\Temp\ABC*.bat

Unfortunately, for some reason, that allows all batch files to still be run.  My guess is it sees the wildcard, and just ignores the fact that I have 3 characters preceding it.

Is there a way I can put in an exception to my path rule, that will let me run batch files that use the name ABCxxxx.bat but block all other batch files?

Thanks
0
Comment
Question by:Vjz1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
2 Comments
 

Accepted Solution

by:
Vjz1 earned 0 total points
ID: 39625045
I've resolved this on my own guys.

While the file name exactly is "Abc1234.bat" App Locker interprets the name to be "ABC1234.bat"  I know this because I looked at the event log on the workstation and saw the block entry.

Once I changed my rule to use "ABC*.bat" as the exception, instead of "Abc*.bat' everything works perfectly.
0
 

Author Closing Comment

by:Vjz1
ID: 39625047
I resolved the issue on my own.
0

Featured Post

Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…
Suggested Courses

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question